Overview 22,371 matches · 355 in Waratek scope · 19 protected · 298 exploited · 45 CISA KEV · 9,012 public PoC · 666 EPSS ≥ 0.5
22,371matches
355in Waratek scope1.6%
19protected0.1%
298exploited1.3%
45CISA KEV0.2%
9,012public PoC40.3%
666EPSS ≥ 0.53.0%
Protected by Waratek
19
0.1%
Rule in development
0
0.0%
Mitigation candidate
17
0.1%
No exploit published
319
1.4%
Outside Waratek scope
282
1.3%
Not applicable
21,734
97.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
19
0.1%
partly blocked
0
0.0%
not blocked
22,352
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,162 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
20021,023
Protected by Waratek1
Mitigation candidate2
No exploit published8
Outside Waratek scope8
Not applicable1,004
High1,023
blocked by ARMR today1
not blocked1,022
Exploited9
Working exploit published276
Forecast only3
No public exploit735
2003674
Mitigation candidate2
No exploit published7
Outside Waratek scope4
Not applicable661
High674
not blocked674
Exploited10
Working exploit published236
No public exploit428
2004973
Protected by Waratek1
No exploit published5
Outside Waratek scope4
Not applicable963
High973
blocked by ARMR today1
not blocked972
Exploited10
Working exploit published302
No public exploit661
20052,048
No exploit published30
Outside Waratek scope10
Not applicable2,008
High2,048
not blocked2,048
Exploited11
Working exploit published658
Forecast only5
No public exploit1,374
20062,763
Protected by Waratek4
No exploit published62
Outside Waratek scope63
Not applicable2,634
High2,763
blocked by ARMR today4
not blocked2,759
Exploited26
Working exploit published1,197
Proof of concept only1
Forecast only4
No public exploit1,535
20073,162
Protected by Waratek3
Mitigation candidate1
No exploit published64
Outside Waratek scope26
Not applicable3,068
High3,162
blocked by ARMR today3
not blocked3,159
Exploited32
Working exploit published1,405
Proof of concept only1
Forecast only4
No public exploit1,720
20082,846
Protected by Waratek3
Mitigation candidate1
No exploit published42
Outside Waratek scope44
Not applicable2,756
High2,846
blocked by ARMR today3
not blocked2,843
Exploited33
Working exploit published1,492
Proof of concept only2
Forecast only8
No public exploit1,311
20092,734
Protected by Waratek3
Mitigation candidate4
No exploit published45
Outside Waratek scope26
Not applicable2,656
High2,734
blocked by ARMR today3
not blocked2,731
Exploited54
Working exploit published1,424
No public exploit1,256
20102,093
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope41
Not applicable2,025
High2,093
blocked by ARMR today2
not blocked2,091
Exploited53
Working exploit published730
Forecast only6
No public exploit1,304
20111,784
Protected by Waratek1
Mitigation candidate4
No exploit published15
Outside Waratek scope44
Not applicable1,720
High1,784
blocked by ARMR today1
not blocked1,783
Exploited38
Working exploit published380
Proof of concept only1
Forecast only2
No public exploit1,363
2012221
No exploit published5
Outside Waratek scope5
Not applicable211
High221
not blocked221
Exploited3
Working exploit published51
Forecast only1
No public exploit166
1988199019921994199619982000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-1418 | High | 2012-02-29 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. |
| CVE-2012-0365 | High | 2012-02-25 | Not applicable | No public exploit | Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009. |
| CVE-2012-0364 | High | 2012-02-25 | Not applicable | No public exploit | Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allow remote attackers to replace the configuration file via an upload request to an unspecified URL, aka Bug ID CSCtw55495. |
| CVE-2012-0363 | High | 2012-02-25 | Not applicable | No public exploit | The web interface on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability," aka Bug ID CSCtt46871. |
| CVE-2012-1210 | High | 2012-02-24 | Not applicable | Working exploit published | SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2012-1206 | High | 2012-02-24 | Not applicable | No public exploit | Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt), which triggers a heap-based buffer overflow. |
| CVE-2012-1205 | High | 2012-02-24 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. |
| CVE-2012-0999 | High | 2012-02-24 | Not applicable | No public exploit | SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter. |
| CVE-2012-0998 | High | 2012-02-24 | Not applicable | No public exploit | Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter. |
| CVE-2012-1294 | High | 2012-02-23 | Not applicable | Working exploit published | SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. |
| CVE-2012-1288 | High | 2012-02-23 | Not applicable | No public exploit | The UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an administrative account, which makes it easier for remote attackers to obtain access via an HTTP session. |
| CVE-2012-0870 | High | 2012-02-23 | Not applicable | No public exploit | Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion. |
| CVE-2012-0315 | High | 2012-02-22 | Not applicable | No public exploit | Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file. |
| CVE-2012-0223 | High | 2012-02-22 | Not applicable | No public exploit | Untrusted search path vulnerability in 7-Technologies (7T) TERMIS 2.10 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0224. |
| CVE-2012-1226 | High | 2012-02-21 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php. |
| CVE-2012-1225 | High | 2012-02-21 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php. |
| CVE-2012-1222 | High | 2012-02-21 | Not applicable | No public exploit | Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23. |
| CVE-2012-1218 | High | 2012-02-21 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components. |
| CVE-2012-0244 | High | 2012-02-21 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input. |
| CVE-2012-0243 | High | 2012-02-21 | Not applicable | No public exploit | Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname. |
| CVE-2012-0242 | High | 2012-02-21 | Not applicable | Working exploit published | Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string. |
| CVE-2012-0240 | High | 2012-02-21 | Not applicable | No public exploit | GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-0238 | High | 2012-02-21 | Not applicable | No public exploit | Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-0234 | High | 2012-02-21 | Not applicable | No public exploit | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL. |
| CVE-2012-0224 | High | 2012-02-21 | Not applicable | No public exploit | Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223. |
| CVE-2011-4526 | High | 2012-02-21 | Not applicable | No public exploit | Buffer overflow in an ActiveX control in Advantech/BroadWin WebAccess before 7.0 might allow remote attackers to execute arbitrary code via a long string value in unspecified parameters. |
| CVE-2011-4525 | High | 2012-02-21 | Not applicable | No public exploit | Advantech/BroadWin WebAccess before 7.0 allows remote attackers to trigger the extraction of arbitrary web content into a batch file on a client system, and execute this batch file, via unspecified vectors. |
| CVE-2011-4524 | High | 2012-02-21 | Not applicable | No public exploit | Buffer overflow in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via a long string value in unspecified parameters. |
| CVE-2011-4521 | High | 2012-02-21 | Not applicable | No public exploit | SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via crafted string input. |
| CVE-2011-4187 | High | 2012-02-21 | Not applicable | No public exploit | Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173. |
| CVE-2011-4186 | High | 2012-02-21 | Not applicable | No public exploit | Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705. |
| CVE-2011-4185 | High | 2012-02-21 | Not applicable | No public exploit | The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436. |
| CVE-2011-1914 | High | 2012-02-21 | Not applicable | No public exploit | Buffer overflow in the Advantech ADAM OLE for Process Control (OPC) Server ActiveX control in ADAM OPC Server before 3.01.012, Modbus RTU OPC Server before 3.01.010, and Modbus TCP OPC Server before 3.01.010 allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-1200 | High | 2012-02-18 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php. |
| CVE-2012-1199 | High | 2012-02-18 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php or (39) setup/base_conf_contents.php; (40) GLOBALS[user_session_path] parameter to includes/base_state_common.inc.php; (41) BASE_Language parameter to setup/base_conf_contents.php; or (42) ado_inc_php parameter to setup/setup2.php. |
| CVE-2012-1198 | High | 2012-02-18 | Not applicable | Working exploit published | base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action. |
| CVE-2012-1197 | High | 2012-02-18 | Not applicable | No public exploit | Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow. |
| CVE-2012-1195 | High | 2012-02-18 | Not applicable | Working exploit published | Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root. |
| CVE-2011-4113 | High | 2012-02-17 | Not applicable | No public exploit | SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments." |
| CVE-2012-0756 | High | 2012-02-16 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0755. |
| CVE-2012-0755 | High | 2012-02-16 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0756. |
| CVE-2012-0754 | High | 2012-02-16 | Not applicable | Exploited | Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2012-0753 | High | 2012-02-16 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted MP4 data. |
| CVE-2012-0752 | High | 2012-02-16 | Not applicable | No public exploit | Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an unspecified "type confusion." |
| CVE-2012-0751 | High | 2012-02-16 | Not applicable | No public exploit | The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2012-0352 | High | 2012-02-16 | Not applicable | No public exploit | Cisco NX-OS 4.2.x before 4.2(1)SV1(5.1) on Nexus 1000v series switches; 4.x and 5.0.x before 5.0(2)N1(1) on Nexus 5000 series switches; and 4.2.x before 4.2.8, 5.0.x before 5.0.5, and 5.1.x before 5.1.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (netstack process crash and device reload) via a malformed IP packet, aka Bug IDs CSCti23447, CSCti49507, and CSCtj01991. |
| CVE-2011-3021 | High | 2012-02-16 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to subframe loading. |
| CVE-2011-3018 | High | 2012-02-16 | Not applicable | No public exploit | Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to path rendering. |
| CVE-2012-0766 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, and CVE-2012-0764. |
| CVE-2012-0764 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, and CVE-2012-0766. |
| CVE-2012-0763 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0764, and CVE-2012-0766. |
| CVE-2012-0762 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. |
| CVE-2012-0761 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. |
| CVE-2012-0760 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. |
| CVE-2012-0759 | High | 2012-02-15 | Not applicable | No public exploit | Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0771. |
| CVE-2012-0758 | High | 2012-02-15 | Not applicable | No public exploit | Heap-based buffer overflow in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code via unspecified vectors. |
| CVE-2012-0757 | High | 2012-02-15 | Not applicable | No public exploit | The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. |
| CVE-2012-0508 | High | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX, 1.3.0 and earlier, and 1.2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2012-0505 | High | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization. |
| CVE-2012-0504 | High | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install and the Java Update mechanism. |
| CVE-2012-0503 | High | 2012-02-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n. |
| CVE-2012-0500 | High | 2012-02-15 | Outside Waratek scope | Working exploit published | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. |
| CVE-2012-0499 | High | 2012-02-15 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier; and JavaFX 2.0.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2012-0498 | High | 2012-02-15 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2012-0497 | High | 2012-02-15 | No exploit published | No public exploit | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. |
| CVE-2012-1077 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-1075 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-1074 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-1072 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-1071 | High | 2012-02-14 | Not applicable | Exploited | SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012. |
| CVE-2012-1067 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2012-1063 | High | 2012-02-14 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do. |
| CVE-2012-1061 | High | 2012-02-14 | Not applicable | No public exploit | SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2012-0155 | High | 2012-02-14 | Not applicable | Forecast only | Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Remote Code Execution Vulnerability." |
| CVE-2012-0154 | High | 2012-02-14 | Not applicable | No public exploit | Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers keyboard layout errors, aka "Keyboard Layout Use After Free Vulnerability." |
| CVE-2012-0150 | High | 2012-02-14 | Not applicable | No public exploit | Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file, aka "Msvcrt.dll Buffer Overflow Vulnerability." |
| CVE-2012-0149 | High | 2012-02-14 | Not applicable | No public exploit | afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability." |
| CVE-2012-0148 | High | 2012-02-14 | Not applicable | No public exploit | afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "AfdPoll Elevation of Privilege Vulnerability." |
| CVE-2012-0138 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0136, and CVE-2012-0137. |
| CVE-2012-0137 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0136, and CVE-2012-0138. |
| CVE-2012-0136 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0137, and CVE-2012-0138. |
| CVE-2012-0020 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0136, CVE-2012-0137, and CVE-2012-0138. |
| CVE-2012-0019 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0020, CVE-2012-0136, CVE-2012-0137, and CVE-2012-0138. |
| CVE-2012-0015 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Heap Corruption Vulnerability." |
| CVE-2012-0014 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Unmanaged Objects Vulnerability." |
| CVE-2012-0011 | High | 2012-02-14 | Not applicable | No public exploit | Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "HTML Layout Remote Code Execution Vulnerability." |
| CVE-2010-5083 | High | 2012-02-14 | Not applicable | Working exploit published | SQL injection vulnerability in the Web_Links module for PHP-Nuke 8.0 allows remote attackers to execute arbitrary SQL commands via the url parameter in an Add action to modules.php. |
| CVE-2012-1047 | High | 2012-02-12 | Not applicable | Working exploit published | Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter in an Online_help action. |
| CVE-2012-0452 | High | 2012-02-11 | Not applicable | No public exploit | Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an nsXBLDocumentInfo::ReadPrototypeBindings function call, related to the cycle collector's access to a hash table containing a stale XBL binding. |
| CVE-2011-4534 | High | 2012-02-10 | Not applicable | No public exploit | ZenSysSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (service crash) or possibly execute arbitrary code via a series of connections and disconnections on TCP port 1101, aka Reference Number 25212. |
| CVE-2011-4533 | High | 2012-02-10 | Not applicable | No public exploit | zenAdminSrv.exe in Ing. Punzenberger COPA-DATA zenon 6.51 SP0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted packet to TCP port 50777, aka Reference Number 25240. |
| CVE-2011-4039 | High | 2012-02-10 | Not applicable | No public exploit | Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation." |
| CVE-2011-3966 | High | 2012-02-09 | Not applicable | No public exploit | Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data. |
| CVE-2011-3961 | High | 2012-02-09 | Not applicable | No public exploit | Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process. |
| CVE-2011-3959 | High | 2012-02-09 | Not applicable | No public exploit | Buffer overflow in the locale implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. |
| CVE-2011-3957 | High | 2012-02-09 | Not applicable | No public exploit | Use-after-free vulnerability in the garbage-collection functionality in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving PDF documents. |
| CVE-2011-3955 | High | 2012-02-09 | Not applicable | No public exploit | Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that trigger the aborting of an IndexedDB transaction. |
| CVE-2011-3953 | High | 2012-02-09 | Not applicable | No public exploit | Google Chrome before 17.0.963.46 does not prevent monitoring of the clipboard after a paste event, which has unspecified impact and remote attack vectors. |
| CVE-2012-1029 | High | 2012-02-08 | Not applicable | Working exploit published | SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2012-1026 | High | 2012-02-08 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters. |